add text query length check

tarkov-database · Jul 17, 2020 · 9d61691 · 9d61691
1 parent df41844
commit 9d61691
Show file tree

Hide file tree

Showing 2 changed files with 48 additions and 0 deletions.
diff --git a/controller/item.go b/controller/item.go
@@ -29,6 +29,12 @@ func ItemIndexGET(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
 			return
 		}
 
+		if l := len(txt); l < 3 || l > 32 {
+			s := &Status{}
+			s.BadRequest("Query string has an invalid length").Render(w)
+			return
+		}
+
 		if !isAlnumBlankPunct(txt) {
 			s := &Status{}
 			s.BadRequest("Query string contains invalid characters").Render(w)
@@ -142,6 +148,12 @@ Loop:
 				return
 			}
 
+			if l := len(txt); l < 3 || l > 32 {
+				s := &Status{}
+				s.BadRequest("Query string has an invalid length").Render(w)
+				return
+			}
+
 			if !isAlnumBlankPunct(txt) {
 				s := &Status{}
 				s.BadRequest("Query string contains invalid characters").Render(w)

diff --git a/controller/location.go b/controller/location.go
@@ -50,6 +50,18 @@ Loop:
 				return
 			}
 
+			if l := len(txt); l < 3 || l > 32 {
+				s := &Status{}
+				s.BadRequest("Query string has an invalid length").Render(w)
+				return
+			}
+
+			if !isAlnumBlankPunct(txt) {
+				s := &Status{}
+				s.BadRequest("Query string contains invalid characters").Render(w)
+				return
+			}
+
 			result, err = location.GetByText(txt, opts)
 			if err != nil {
 				handleError(err, w)
@@ -204,6 +216,18 @@ Loop:
 				return
 			}
 
+			if l := len(txt); l < 3 || l > 32 {
+				s := &Status{}
+				s.BadRequest("Query string has an invalid length").Render(w)
+				return
+			}
+
+			if !isAlnumBlankPunct(txt) {
+				s := &Status{}
+				s.BadRequest("Query string contains invalid characters").Render(w)
+				return
+			}
+
 			result, err = feature.GetByText(txt, lID, opts)
 			if err != nil {
 				handleError(err, w)
@@ -423,6 +447,18 @@ Loop:
 				return
 			}
 
+			if l := len(txt); l < 3 || l > 32 {
+				s := &Status{}
+				s.BadRequest("Query string has an invalid length").Render(w)
+				return
+			}
+
+			if !isAlnumBlankPunct(txt) {
+				s := &Status{}
+				s.BadRequest("Query string contains invalid characters").Render(w)
+				return
+			}
+
 			result, err = featuregroup.GetByText(txt, lID, opts)
 			if err != nil {
 				handleError(err, w)